Issue metadata
Sign in to add a comment
|
CHECK failure: FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5436877461782528 Fuzzer: binaryen_wasm_fuzzer Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg v8::internal::compiler::RegisterAllocatorVerifier::ValidateUse v8::internal::compiler::RegisterAllocatorVerifier::VerifyGapMoves Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5436877461782528 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Aug 25
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/8fe01fea4e1d7591645f89fb155a6a6bd89ed3b4 ([arm] Implement I64Atomic operations on Arm). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Aug 25
,
Aug 26
gdeepti -- can you please comment on what happens in the absence of this CHECK? It doesn't seem like it leads to any security issue so setting Security_Impact-None.
,
Aug 28
Security_Impact-None is correct as this will only be executed behind a flag, and the case that this is hitting is when the output nodes are optimized, this is the first in the series of checks to make sure that nothing unexpected happens. Fix is WIP, this can probably be merged with 877791, but I'll confirm once I can test the fix on both these cases.
,
Sep 20
This is fixed by - https://chromium-review.googlesource.com/c/v8/v8/+/1195910. Will need to be merged to M70 though.
,
Sep 20
This bug requires manual review: M70 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 20
This crash occurs very frequently on linux platform and is likely preventing the fuzzer binaryen_wasm_fuzzer from making much progress. Fixing this will allow more bugs to be found. Marking this bug as a blocker for next Beta release. If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
,
Sep 21
,
Sep 21
,
Sep 21
,
Sep 25
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 26
There's a bigger refactoring change that needs that this depends on, that did not make it to M70. I'm going to defer merging this for now - removing merge labels.
,
Sep 27
ClusterFuzz testcase 5436877461782528 is still reproducing on tip-of-tree build (trunk). Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
,
Sep 28
I'm afraid the VRP panel declined to reward for this, as this bug would have been fixed without this report (see https://bugs.chromium.org/p/v8/issues/detail?id=6532) Cheers!
,
Oct 4
ClusterFuzz has detected this issue as fixed in range 56359:56360. Detailed report: https://clusterfuzz.com/testcase?key=5436877461782528 Fuzzer: binaryen_wasm_fuzzer Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg v8::internal::compiler::RegisterAllocatorVerifier::ValidateUse v8::internal::compiler::RegisterAllocatorVerifier::VerifyGapMoves Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=56359:56360 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5436877461782528 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 4
ClusterFuzz testcase 5436877461782528 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Dec 28
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Aug 25Labels: Test-Predator-Auto-Components